From 282852d261970f32f7d547e94ae1fadc3b1a28e1 Mon Sep 17 00:00:00 2001 From: deathride58 Date: Thu, 11 Jun 2020 23:43:14 -0400 Subject: [PATCH 1/2] Fixes a pair of DoS vectors. This isn't very urgent since skids haven't picked up on these specific ones yet, but now that I'm making this set of PRs, it's only a matter of when now. --- code/modules/client/client_defines.dm | 3 +++ code/modules/mob/dead/new_player/new_player.dm | 9 ++++++--- code/modules/mob/dead/observer/observer.dm | 6 ++++++ code/modules/mob/living/silicon/silicon.dm | 6 ++++++ 4 files changed, 21 insertions(+), 3 deletions(-) diff --git a/code/modules/client/client_defines.dm b/code/modules/client/client_defines.dm index 99caba8a9ac..e629feeec27 100644 --- a/code/modules/client/client_defines.dm +++ b/code/modules/client/client_defines.dm @@ -172,3 +172,6 @@ /// Last asset send job id. var/last_asset_job = 0 var/last_completed_asset_job = 0 + + //rate limiting for the crew manifest + var/crew_manifest_delay diff --git a/code/modules/mob/dead/new_player/new_player.dm b/code/modules/mob/dead/new_player/new_player.dm index b8b08c9e50e..b19e91588c5 100644 --- a/code/modules/mob/dead/new_player/new_player.dm +++ b/code/modules/mob/dead/new_player/new_player.dm @@ -177,9 +177,6 @@ AttemptLateSpawn(href_list["SelectedJob"]) return - if(!ready && href_list["preference"]) - if(client) - client.prefs.process_link(src, href_list) else if(!href_list["late_join"]) new_player_panel() @@ -458,6 +455,12 @@ qdel(src) /mob/dead/new_player/proc/ViewManifest() + if(!client) + return + if(world.time < client.crew_manifest_delay) + return + client.crew_manifest_delay = world.time + (1 SECONDS) + var/dat = "" dat += "

Crew Manifest

" dat += GLOB.data_core.get_manifest_html() diff --git a/code/modules/mob/dead/observer/observer.dm b/code/modules/mob/dead/observer/observer.dm index 2d07aeee832..326a365c9bb 100644 --- a/code/modules/mob/dead/observer/observer.dm +++ b/code/modules/mob/dead/observer/observer.dm @@ -647,6 +647,12 @@ This is the proc mobs get to turn into a ghost. Forked from ghostize due to comp set name = "View Crew Manifest" set category = "Ghost" + if(!client) + return + if(world.time < client.crew_manifest_delay) + return + client.crew_manifest_delay = world.time + (1 SECONDS) + var/dat dat += "

Crew Manifest

" dat += GLOB.data_core.get_manifest_html() diff --git a/code/modules/mob/living/silicon/silicon.dm b/code/modules/mob/living/silicon/silicon.dm index 83a8eb3263a..4055defbefb 100644 --- a/code/modules/mob/living/silicon/silicon.dm +++ b/code/modules/mob/living/silicon/silicon.dm @@ -335,6 +335,12 @@ usr << browse(list, "window=laws") /mob/living/silicon/proc/ai_roster() + if(!client) + return + if(world.time < client.crew_manifest_delay) + return + client.crew_manifest_delay = world.time + (1 SECONDS) + var/datum/browser/popup = new(src, "airoster", "Crew Manifest", 387, 420) popup.set_content(GLOB.data_core.get_manifest_html()) popup.open() From af9e72858914b55dcc549c1873c1331e9f1d1fc2 Mon Sep 17 00:00:00 2001 From: deathride58 Date: Fri, 12 Jun 2020 13:56:57 -0400 Subject: [PATCH 2/2] autodoc compatibility --- code/modules/client/client_defines.dm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code/modules/client/client_defines.dm b/code/modules/client/client_defines.dm index e629feeec27..f9e2ceaffe0 100644 --- a/code/modules/client/client_defines.dm +++ b/code/modules/client/client_defines.dm @@ -173,5 +173,5 @@ var/last_asset_job = 0 var/last_completed_asset_job = 0 - //rate limiting for the crew manifest + /// rate limiting for the crew manifest var/crew_manifest_delay